RAGFlow CVE-2026-93013

Requires a valid RAGFlow access token (authenticated - PR:L) and network reachability to the tenant/dev import endpoints (dev_insert_chunks_from_file, dev_insert_metadata_from_file). The attacker supplies an absolute file_path; there is no additional non-default configuration required beyond having the import endpoints exposed. Key limiting factor: disclosure is bounded to files whose contents parse into the JSON structure the importer expects and then writes to a dataset, so arbitrary binary or non-conforming files cannot be exfiltrated cleanly - this significantly reduces the set of readable secrets versus a general arbitrary-file-read. No user interaction is needed beyond the attacker's own request.

This is a genuine but moderate-severity issue, not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N = 5.3) describes an authenticated, network-reachable, low-complexity information-disclosure flaw with LOW confidentiality impact and no integrity or availability impact. The PR:L means a valid access token is required, which meaningfully narrows the attacker population to users already inside the trust boundary. Impact is further constrained by the vulnerability's own mechanics: per the description, disclosure is limited to files that match the expected JSON structure the importer then writes to a dataset, so this is not a clean read of arbitrary secrets (e.g., /etc/shadow content would not parse). No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no signal of active exploitation - the correct status is 'no public exploit identified at time of analysis.' The signals are internally consistent (network vector, authenticated, confidentiality-only); the main caveat is the JSON-structure limitation, which makes real-world value lower than a raw 'arbitrary file read' label would suggest. Patch availability (PR #19591 / commit aa78e8d2) makes remediation straightforward and should be the primary response.

An authenticated RAGFlow user (or an attacker who has obtained a valid access token) calls the dev_insert_chunks_from_file or dev_insert_metadata_from_file import endpoint and supplies an absolute path such as /var/lib/ragflow/config.json in the file_path parameter. Because path validation is missing, the service reads that server-side file and, if it parses as the expected JSON structure, ingests its contents into a dataset the attacker can then view. No public exploit code is identified in the provided data.